2 files changed, 55 insertions, 3 deletions

diff --git a/oxish/src/bin/oxish-server.rs b/oxish/src/bin/oxish-server.rs
index a88995e..b95fb12 100644
--- a/oxish/src/bin/oxish-server.rs
+++ b/oxish/src/bin/oxish-server.rs
@@ -3,7 +3,7 @@ use std::{
     env,
     fs::{self, File},
     io::{self, Write},
-    path::PathBuf,
+    path::{Path, PathBuf},
     sync::Arc,
 };
 
@@ -49,8 +49,17 @@ async fn main() -> anyhow::Result<()> {
             Err(err) => return Err(err.into()),
         }
     } else {
-        let pkcs8 = Zeroizing::new(fs::read(&args.host_key_file)?);
-        HostKeys::new([pkcs8].into_iter(), provider)?
+        match HostKeys::from_dir(Path::new("/etc/ssh"), provider) {
+            Ok(host_keys) => {
+                info!(len = host_keys.len(), "loaded host keys from /etc/ssh");
+                host_keys
+            }
+            Err(error) => {
+                eprintln!("failed to load host keys from /etc/ssh: {error}");
+                let pkcs8 = Zeroizing::new(fs::read(&args.host_key_file)?);
+                HostKeys::new([pkcs8].into_iter(), provider)?
+            }
+        }
     };
 
     let session_bin = match args.session_bin {
diff --git a/oxish/src/tests.rs b/oxish/src/tests.rs
index 3470b97..4b9d65d 100644
--- a/oxish/src/tests.rs
+++ b/oxish/src/tests.rs
@@ -303,6 +303,49 @@ impl CliClient {
     }
 }
 
+#[cfg(feature = "aws-lc")]
+#[tokio::test]
+async fn host_keys_from_dir_aws_lc() {
+    host_keys_from_dir(aws_lc::DEFAULT_PROVIDER).await.unwrap();
+}
+
+#[cfg(feature = "graviola")]
+#[tokio::test]
+async fn host_keys_from_dir_graviola() {
+    host_keys_from_dir(graviola::DEFAULT_PROVIDER)
+        .await
+        .unwrap();
+}
+
+async fn host_keys_from_dir(provider: &'static dyn CryptoProvider) -> anyhow::Result<()> {
+    let dir = TempDir::new()?;
+    for key_type in ["ed25519", "ecdsa", "rsa"] {
+        let status = Command::new("ssh-keygen")
+            .arg("-q")
+            .args(["-t", key_type])
+            .args(["-N", ""])
+            .args(["-C", "oxish-e2e"])
+            .arg("-f")
+            .arg(dir.path().join(format!("ssh_host_{key_type}_key")))
+            .status()
+            .await
+            .context("failed to run ssh-keygen")?;
+        assert!(status.success(), "ssh-keygen failed");
+    }
+
+    let host_keys = HostKeys::from_dir(dir.path(), provider)?;
+    let mut algorithms = Vec::new();
+    for algorithm in host_keys.algorithms() {
+        algorithms.push(algorithm);
+    }
+
+    assert_eq!(algorithms.len(), 2, "unexpected algorithms: {algorithms:?}");
+    assert!(algorithms.contains(&PublicKeyAlgorithm::Ed25519));
+    assert!(algorithms.contains(&PublicKeyAlgorithm::EcdsaSha2Nistp256));
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn verify_keys() {
     let providers = [